CVE-2012-5076

CVE-2012-5076 is a Java sandbox bypass caused by the default Java security properties configuration, which failed to restrict access to the com.sun.org.glassfish.external and com.sun.org.glassfish.gmbal packages. The flaw is triggered when an untrusted Java application or applet is run and abuses access to these packages to escape the Java sandbox. An attacker who successfully exploits it gains the ability to execute code with elevated privileges beyond the sandbox restrictions that are supposed to contain untrusted Java code. Any environment running affected Oracle Java SE and executing untrusted Java code — most notably browsers with the Java plugin loading applets — is exposed, and CISA lists Oracle Java SE as the affected product. CISA added this vulnerability to the KEV catalog on 2022-03-28, indicating known exploitation in the wild; no public proof-of-concept is known, and ransomware use is unknown.

What to do: Apply Oracle's updates per vendor instructions, as required by the CISA KEV listing — upgrade all Java SE deployments to the current patched release and verify no systems remain on unpatched builds. As mitigation, disable the Java browser plugin or block untrusted applets and applications where full patching is not yet possible, and monitor for exploitation activity consistent with exploit kit delivery.